DATABRICKS-MLP Question 61

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A0

  ,B,C - Correct answer s : A, B, C — Deploy production compute to its own Databricks workspace with its own network configuration, separate from the workspace used for dev and staging.; Use a distinct service principal per environment for CI/CD deployments, so a compromised or misconfigured dev credential cannot deploy or modify prod resources.; Scope `grants` on production `registered_models` resources to only the specific principals that need access, rather than granting broadly to every workspace user. A . A separate workspace with its own network configuration adds an isolation layer at the compute and network level, which catalog separation inside a shared workspace does not provide on its own. B . Distinct per-environment service principals limit the blast radius of a compromised or misconfigured dev credential, adding an identity-level control on top of namespace separation. C . Scoping grants tightly to the specific principals that need access on production model resources adds a fine-grained authorization layer beyond simply placing the model in a separate catalog. D . A single shared service principal with broad rights across every environment removes the identity-level boundary between environments, so a dev-side compromise could reach production resources. E . Catalog separation alone governs data and metadata namespace boundaries; it does not address compute network isolation or scoped CI/CD identities, so relying on it exclusively leaves those layers uncovered for a regulated workload. F . Giving every data scientist identical permissions regardless of environment ignores that production sensitivity typically calls for tighter access than a dev sandbox, undermining layered governance rather than adding to it.